Malicious code in merge-grid-stats (npm)
The npm package merge-grid-stats contained malicious code in its postinstall hook that performed reconnaissance on the host system, including Kubernetes credential access and environment variable enumeration for secrets. The package was disguised as a grid game statistics utility but executed unauthorized system inspection and credential harvesting on installation.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed merge-grid-stats via npm
- Ecosystems
- Attack vectors
- Affected entities
- merge-grid-statsnpm package with malicious postinstall hook
The npm package merge-grid-stats was published with malicious code embedded in a postinstall hook (node install-cb.js) that executes automatically during npm install. Despite advertising itself as a 2048-style grid game statistics utility, the package performed unauthorized reconnaissance activities unrelated to its stated purpose.\n\nThe malicious postinstall script executed system commands including uname -a and id, read container and Kubernetes metadata from /proc/1/cgroup, /proc/mounts, and checked for Docker socket presence. Most critically, it accessed the Kubernetes service-account token and namespace at /var/run/secrets/kubernetes.io/serviceaccount/, which are credentials used for container-to-cluster authentication.\n\nThe script also enumerated filesystem directories (/, /root, /root/projects), performed host write tests, inspected network configuration, and scanned the process environment for variables matching patterns like token, secret, key, password, db_, redis, and s3. Collected data, including the length of the Kubernetes service-account token and environment variable keys, was written to NCODE_ESCAPE.txt in the current working directory and two parent directories.\n\nThe package metadata (author: "merge-tools ") and the mismatch between declared purpose and actual behavior indicate intentional deception. This represents a supply chain attack combining credential access and container-escape reconnaissance staging.
Indicators of compromise
- Packages
- merge-grid-stats
Remediation
- Immediately uninstall merge-grid-stats from all systems and CI/CD pipelines
- Audit npm install logs to identify all systems where merge-grid-stats was installed
- Rotate all Kubernetes service-account tokens that may have been exposed
- Review and rotate any secrets, API keys, database credentials, and cloud credentials (AWS S3, Redis, etc.) that were present in environment variables on affected systems
- Scan affected systems for the NCODE_ESCAPE.txt file and review its contents to determine what data was exfiltrated
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall hooks
- Use npm audit and tools like Snyk to identify and block known malicious packages
- Consider using npm lockfiles and package integrity verification to prevent unexpected package installations
Sources
- GitHub Advisory GHSA-vqp7-j6jf-34qm · GitHub Advisory Database
Cite this entry
"Malicious code in merge-grid-stats (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-merge-grid-stats-npm-epow66
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in banana-stand
The npm package banana-stand contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - activecritical
Malware in rendezvous-js
The npm package rendezvous-js contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package